Design/Logic Flaw

The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...

Stable Yield Credit Security Breach

Stable Yield Credit is a new protocol for decentralized lending, stablecoin, and automated market maker AMM in one for the Stable Yield Credit community. Stable Yield Credit suffers from a security vulnerability that stems from certain miscalculations in the deposit function. An attacker could...

ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)

Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site ScriptingXSS Date: 2020- 10- 29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.1 Tested on: Kali Linux 2020.3 Proof Of Concept: ChurchCRM application allo...

ChurchCRM 4.2.1 Cross Site Scripting

Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site ScriptingXSS Date: 2020- 10- 29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.1 Tested on: Kali Linux 2020.3 Proof Of Concept: ChurchCRM application allo...

Check Washing

I cant believe that check washing is still a thing: "Check washing" is a practice where thieves break into mailboxes or otherwise steal mail, find envelopes with checks, then use special solvents to remove the information on that check except for the signature and then change the payee and the...

CVE-2020-9062

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

CVE-2020-9062

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

CVE-2020-10124

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the...

CVE-2020-10124

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the...

Design/Logic Flaw

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the...

Design/Logic Flaw

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

CVE-2020-9062

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

CVE-2020-9062

Diebold Nixdorf ProCash 2100xe USB ATMs (Wincor Probase 1.1.30) are affected by CVE-2020-9062. The CCDM–host communication lacks encryption, authentication, and integrity verification, enabling a physically proximate attacker to intercept/modify deposit messages (e.g., amount/value) and commit de...

CVE-2020-10124

CVE-2020-10124 affects NCR SelfServ ATMs running APTRA XFS 05.01.00. The vulnerability is due to the BNA–host communications not being encrypted, authenticated, or integrity-checked, enabling a physically proximate attacker to potentially execute arbitrary code and commit deposit forgery. The doc...

CVE-2020-10124

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the...

Diebold Nixdorf ProCash 2100xe USB ATM does not adequately secure communications between CCDM and host

Overview Diebold Nixdorf 2100xe USB automated teller machines ATMs are vulnerable to physical attacks on the communication channel between the cash and check deposit module CCDM and the host computer. An attacker with physical access to internal ATM components may be able to exploit this...

Online Trade - Online trading and cryptocurrency investment system security breach

Online Trade - Online trading and cryptocurrency investment system is an online forex and currency trading system developed using the Laravel framework. A security vulnerability exists in Online Trade - Online trading and cryptocurrency investment system. A remote attacker can exploit this...

Online Trade - Online trading and cryptocurrency investment system security breach

Online Trade - Online trading and cryptocurrency investment system is a set of online foreign exchange and currency trading system developed using the Laravel framework. A security vulnerability exists in Online Trade - Online trading and cryptocurrency investment system. A remote attacker can...

The vulnerability of the User Interface sub-component of the Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management banking analytics system’s simulation model applications allows attackers to create, delete, or modify access rights to protected information, or gain read-only access to data.

The vulnerability of the User Interface sub-component of the Oracle Financial Services Deposit Insurance Calculations component for liquidity risk management in the banking analytical system’s simulation model Oracle Financial Services Applications is related to the lack of protection for...

Monero Public Chain Has Logic Flaw Vulnerability

Monero is a cryptocurrency designed to protect transaction privacy. The vulnerability stems from the fact that transferring 1 XMR to an exchange with a duplicate TX pub key will show up as a 2 XMR deposit, which an attacker can then withdraw from the exchange's wallet.An attacker may be able to...